xmrig | e07b0cd7eca5bc70b07ea786c3ef4da28036c901effa2193a93caf945cb2b334

General

Target

Tray.exe
Size

321KB
MD5

6585cb51ff21007fb9ef936e96c58982
SHA1

7a3d5563460b9935fe84879ee14fabfc7c664825
SHA256

e07b0cd7eca5bc70b07ea786c3ef4da28036c901effa2193a93caf945cb2b334
SHA512

523c7b3ed0907a473eac04c8cb8642eeea1d3a223069f876a7e0bc18075d59f9903319f6b2e3c2fa262158f04c4ad3637568dd9b0558732c8a574ffe566efc7d

Score

10^/10

xmrig miner ransomware spyware stealer

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Drops file in Drivers directory 6 IoCs

Processes:

Tray.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	Tray.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gm.dls	Tray.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui	Tray.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui	Tray.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui	Tray.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\fwpkclnt.sys.mui	Tray.exe

Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
ransomware

Processes:

Tray.exe

description ioc process

File opened for modification C:\Users\Admin\Pictures\ReceiveSuspend.tiff Tray.exe
Drops startup file 1 IoCs

Processes:

Tray.exe

description ioc process

File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini Tray.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\ReceiveSuspend.tiff	Tray.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	Tray.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

Tray.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	Tray.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Tray.exe
File opened for modification	C:\Windows\Web\Wallpaper\Theme2\Desktop.ini	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.15063.0_none_0437af998b0e208e\desktop.ini	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..opini-accessibility_31bf3856ad364e35_10.0.15063.0_none_eb7f363ab6175c3e\Desktop.ini	Tray.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	Tray.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	Tray.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	Tray.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	Tray.exe
File opened for modification	C:\Windows\Downloaded Program Files\desktop.ini	Tray.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	Tray.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	Tray.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..sktopini-sendtouser_31bf3856ad364e35_10.0.15063.0_none_19586abacce7785e\Desktop.ini	Tray.exe
File opened for modification	C:\Windows\WinSxS\x86_microsoft-windows-mail-app_31bf3856ad364e35_10.0.15063.0_none_a64d6b3dd0267b2d\Desktop.ini	Tray.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	Tray.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	Tray.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ie-objectcontrolviewer_31bf3856ad364e35_11.0.15063.0_none_7c2bbc3db7cbacf0\desktop.ini	Tray.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	Tray.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	Tray.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	Tray.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	Tray.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	Tray.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	Tray.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	Tray.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	Tray.exe
File opened for modification	C:\Windows\Media\Desktop.ini	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-mail-app_31bf3856ad364e35_10.0.15063.0_none_026c06c18883ec63\Desktop.ini	Tray.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	Tray.exe
File opened for modification	C:\Users\Public\desktop.ini	Tray.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	Tray.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	Tray.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-fontext_31bf3856ad364e35_10.0.15063.0_none_af9971bc2c6c0486\desktop.ini	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondocuments_31bf3856ad364e35_10.0.15063.0_none_5fe51e9b01006347\desktop.ini	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..2-kf-commonprograms_31bf3856ad364e35_10.0.15063.0_none_5fa2753162f86404\desktop.ini	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..kf-commonadmintools_31bf3856ad364e35_10.0.15063.0_none_662bd76b47731007\desktop.ini	Tray.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-theme2_31bf3856ad364e35_10.0.15063.0_none_e7edc57dddbcc561\Desktop.ini	Tray.exe
File opened for modification	C:\Windows\Fonts\desktop.ini	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commondesktop_31bf3856ad364e35_10.0.15063.0_none_033cfedce922e911\desktop.ini	Tray.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	Tray.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	Tray.exe
File opened for modification	C:\Windows\Offline Web Pages\desktop.ini	Tray.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-programfilesx86_31bf3856ad364e35_10.0.15063.0_none_93939f0ae8aadf65\desktop.ini	Tray.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	Tray.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	Tray.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Tray.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	Tray.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu Places\desktop.ini	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commonstartmenu_31bf3856ad364e35_10.0.15063.0_none_5211b42e358da2ca\desktop.ini	Tray.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3686645723-710336880-414668232-1000\desktop.ini	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-systemtoolsuser_31bf3856ad364e35_10.0.15063.0_none_31bf86f81c563119\Desktop.ini	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-maintenance_31bf3856ad364e35_10.0.15063.0_none_6fae0d35d5f5cd29\Desktop.ini	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-commonvideos_31bf3856ad364e35_10.0.15063.0_none_ed59e293474a6cb5\desktop.ini	Tray.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	Tray.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	Tray.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	Tray.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..2-kf-commonpictures_31bf3856ad364e35_10.0.15063.0_none_91663737b60fa4f6\desktop.ini	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commonstartup_31bf3856ad364e35_10.0.15063.0_none_0d24170c83d741b6\desktop.ini	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell32-kf-public_31bf3856ad364e35_10.0.15063.0_none_681472142b50e5ab\desktop.ini	Tray.exe

Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Drops file in System32 directory 64 IoCs

Processes:

Tray.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\downlevel\API-MS-Win-EventLog-Legacy-L1-1-0.dll	Tray.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnepcl2.inf_amd64_5940f4dc3bf9366e\EP0LXPS-manifest.ini	Tray.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\storufs.inf_amd64_f25a0ad42f53c0f2\storufs.sys	Tray.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wiaca00j.inf_amd64_2b730d5c3b5d1ba1\amd64\CNQ9604\CNQ_412N.DAT	Tray.exe
File opened for modification	C:\Windows\SysWOW64\ko-KR\comctl32.dll.mui	Tray.exe
File opened for modification	C:\Windows\SysWOW64\UevCustomActionTypes.tlb	Tray.exe
File opened for modification	C:\Windows\SysWOW64\mscorier.dll	Tray.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Lxss-Optional-Package~31bf3856ad364e35~amd64~en-US~10.0.15063.0.cat	Tray.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-WaaSAssessment-Package~31bf3856ad364e35~amd64~~10.0.15063.0.cat	Tray.exe
File opened for modification	C:\Windows\SysWOW64\sk-SK\mlang.dll.mui	Tray.exe
File opened for modification	C:\Windows\SysWOW64\wbem\en-US\netswitchteamcim.dll.mui	Tray.exe
File opened for modification	C:\Windows\SysWOW64\C_ISCII.DLL	Tray.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WCN-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.15063.0.cat	Tray.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DeviceGuard-GPEXT-Package~31bf3856ad364e35~amd64~en-US~10.0.15063.0.cat	Tray.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnokcl2.inf_amd64_1e45a4f567fdae98\OKV4PCL6-PipelineConfig.xml	Tray.exe
File opened for modification	C:\Windows\SysWOW64\hu-HU\comdlg32.dll.mui	Tray.exe
File opened for modification	C:\Windows\SysWOW64\lsmproxy.dll	Tray.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Compute-System-VirtualMachine-onecore-Package~31bf3856ad364e35~amd64~~10.0.15063.0.cat	Tray.exe
File opened for modification	C:\Windows\System32\DriverStore\en-US\ndiscap.inf_loc	Tray.exe
File opened for modification	C:\Windows\SysWOW64\Windows.Devices.SmartCards.Phone.dll	Tray.exe
File opened for modification	C:\Windows\SysWOW64\wbem\portabledevicetypes.mof	Tray.exe
File opened for modification	C:\Windows\SysWOW64\mfdvdec.dll	Tray.exe
File opened for modification	C:\Windows\SysWOW64\downlevel\API-MS-Win-Eventing-ClassicProvider-L1-1-0.dll	Tray.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oposdrv.inf_amd64_89ad35ab63ac1a22\oposdrv.dll	Tray.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\urssynopsys.inf_amd64_68d37c01f27b5d51\urssynopsys.sys	Tray.exe
File opened for modification	C:\Windows\SysWOW64\Windows.UI.XamlHost.dll	Tray.exe
File opened for modification	C:\Windows\SysWOW64\Windows.Devices.Picker.dll	Tray.exe
File opened for modification	C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe	Tray.exe
File opened for modification	C:\Windows\SysWOW64\en-US\rdrleakdiag.exe.mui	Tray.exe
File opened for modification	C:\Windows\SysWOW64\C_20871.NLS	Tray.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prndlclw.inf_amd64_22943612af676c5d\DLclW0.GPD	Tray.exe
File opened for modification	C:\Windows\SysWOW64\en-US\Robocopy.exe.mui	Tray.exe
File opened for modification	C:\Windows\SysWOW64\tsgqec.dll	Tray.exe
File opened for modification	C:\Windows\SysWOW64\ntmarta.dll	Tray.exe
File opened for modification	C:\Windows\SysWOW64\wbem\en-US\wsp_health.mfl	Tray.exe
File opened for modification	C:\Windows\SysWOW64\en-US\auditpol.exe.mui	Tray.exe
File opened for modification	C:\Windows\SysWOW64\tlscsp.dll	Tray.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ShellExperienceHost-Package~31bf3856ad364e35~amd64~~10.0.15063.0.cat	Tray.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\sdflauncher.inf_amd64_e77733cbee7e6db0\SDFLauncher.dll	Tray.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnepcl2.inf_amd64_5940f4dc3bf9366e\EP0LXGPW.GPD	Tray.exe
File opened for modification	C:\Windows\SysWOW64\en-US\MFC42.dll.mui	Tray.exe
File opened for modification	C:\Windows\SysWOW64\scesrv.dll	Tray.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnms008.cat	Tray.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\c_mediumchanger.inf_amd64_6220551ad98f242c\c_mediumchanger.inf	Tray.exe
File opened for modification	C:\Windows\SysWOW64\KBDTH2.DLL	Tray.exe
File opened for modification	C:\Windows\SysWOW64\driverquery.exe	Tray.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-PushNotifications-Feature-Package~31bf3856ad364e35~amd64~en-US~10.0.15063.0.cat	Tray.exe
File opened for modification	C:\Windows\SysWOW64\en-US\scksp.dll.mui	Tray.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\en-US\MSFT_ServiceResource.schema.mfl	Tray.exe
File opened for modification	C:\Windows\SysWOW64\sdiageng.dll	Tray.exe
File opened for modification	C:\Windows\SysWOW64\sc.exe	Tray.exe
File opened for modification	C:\Windows\SysWOW64\en-US\sysdm.cpl.mui	Tray.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prncacla.inf_amd64_65d72b0cf837d4c1\Amd64\CNB_0373-MANIFEST.INI	Tray.exe
File opened for modification	C:\Windows\SysWOW64\dtdump.exe	Tray.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netjme.inf_amd64_752bf22f1598bb7e\NETJME.sys	Tray.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netwlv64.inf_amd64_abe96c8dcb5b0eac\netwlv64.inf	Tray.exe
File opened for modification	C:\Windows\SysWOW64\en-US\evr.dll.mui	Tray.exe
File opened for modification	C:\Windows\SysWOW64\F12\Timeline.dll	Tray.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-WWA-Package~31bf3856ad364e35~amd64~en-US~10.0.15063.0.cat	Tray.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prncacla.inf_amd64_65d72b0cf837d4c1\Amd64\CNB_0381.GPD	Tray.exe
File opened for modification	C:\Windows\SysWOW64\en-US\systeminfo.exe.mui	Tray.exe
File opened for modification	C:\Windows\SysWOW64\en-US\oledlg.dll.mui	Tray.exe
File opened for modification	C:\Windows\SysWOW64\playtomenu.dll	Tray.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wdmaudio.inf_amd64_b51edb2b9055d904\wdmaudio.inf	Tray.exe

Drops file in Windows directory 64 IoCs

Processes:

Tray.exe

description	ioc	process
File opened for modification	C:\Windows\SystemApps\ContactSupport_cw5n1h2txyewy\App.xbf	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-d..dataretrievalclient_31bf3856ad364e35_10.0.15063.0_none_d59f603cdc0f5dd4\DeviceMetadataRetrievalClient.dll	Tray.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-n..oyment-languagepack_31bf3856ad364e35_10.0.15063.0_en-us_975e552ebfcd4f8f.manifest	Tray.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-d..s-ntdsatq.resources_31bf3856ad364e35_10.0.15063.0_en-us_d9b20db471ef320a.manifest	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-t..languages.resources_31bf3856ad364e35_10.0.15063.0_lt-lt_39f63523d36ade56\tipresx.dll.mui	Tray.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-security-ngc-keyenum_31bf3856ad364e35_10.0.15063.0_none_0b2128b5cdd4b6b7\ngckeyenum.dll	Tray.exe
File opened for modification	C:\Windows\WinSxS\msil_system.workflow.activities_31bf3856ad364e35_4.0.15552.17062_none_34ec3a6631ad20d8\System.Workflow.Activities.dll	Tray.exe
File opened for modification	C:\Windows\WinSxS\x86_caspol_b03f5f7f11d50a3a_10.0.15063.0_none_25273e3a8c447964\caspol.exe.config	Tray.exe
File opened for modification	C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\WideTile.scale-200.png	Tray.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorpehost.dll	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_mdmkortx.inf_31bf3856ad364e35_10.0.15063.0_none_110435fed978cf3f\mdmkortx.inf	Tray.exe
File opened for modification	C:\Windows\WinSxS\Manifests\wow64_microsoft-onecore-c..ehost-api.resources_31bf3856ad364e35_10.0.15063.0_en-us_35824dc08aa68f34.manifest	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_devicepairingproxy_31bf3856ad364e35_10.0.15063.0_none_4181eb4d4ea17d29\DevicePairingProxy.dll	Tray.exe
File opened for modification	C:\Windows\WinSxS\FileMaps\$$_diagnostics_system_windowsmediaplayermedialibrary_64611465e9119df8.cdf-ms	Tray.exe
File opened for modification	C:\Windows\WinSxS\x86_netfx-aspnet_regbrowser_files_b03f5f7f11d50a3a_10.0.15063.0_none_2a54cb2e6829ec2c\netscape.browser	Tray.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.15063.0_none_39384d9f3be72de5.manifest	Tray.exe
File opened for modification	C:\Windows\InfusedApps\Packages\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\mooning.png	Tray.exe
File opened for modification	C:\Windows\InfusedApps\Packages\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorLargeTile.contrast-white_scale-200.png	Tray.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-RasRip-Package~31bf3856ad364e35~amd64~~10.0.15063.0.mum	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c...appxmain.resources_31bf3856ad364e35_10.0.15063.0_mt-mt_f60a7c04849063ad\resources.mt-MT.pri	Tray.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-font-truetype-taile_31bf3856ad364e35_10.0.15063.0_none_9c7277e4e86517c8.manifest	Tray.exe
File opened for modification	C:\Windows\WinSxS\x86_microsoft-windows-sysdm_31bf3856ad364e35_10.0.15063.0_none_17777074f5ae2032\sysdm.cpl	Tray.exe
File opened for modification	C:\Windows\Boot\PCAT\ja-JP\memtest.exe.mui	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_wiaca00j.inf_31bf3856ad364e35_10.0.15063.0_none_53a73a8467cc268a\amd64\MG8200\CNC_391W.DAT	Tray.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-s..owsercore.resources_31bf3856ad364e35_10.0.15063.0_en-us_0e60559c58a2749b.manifest	Tray.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-offlinefiles-adm_31bf3856ad364e35_10.0.15063.0_none_6acc63d7d131aec3.manifest	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-mfc42x_31bf3856ad364e35_10.0.15063.0_none_0428a77a8e5d7282\mfc42.dll	Tray.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_et-ee_51c0f1bb9bbbf098_msimsg.dll.mui_72e8994f	Tray.exe
File opened for modification	C:\Windows\WinSxS\Manifests\x86_netfx-sbs_sys_enterprisesvc_dll_31bf3856ad364e35_10.0.15063.0_none_161e9740a642ecc4.manifest	Tray.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-r..o-service.resources_31bf3856ad364e35_10.0.15063.0_en-us_91bc4535c98b7109.manifest	Tray.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.Build.xsd	Tray.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-ShareMedia-ControlPanel-Package~31bf3856ad364e35~amd64~~10.0.15063.0.cat	Tray.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\MicrosoftEdgeSquare44x44.targetsize-48.png	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-edp-task_31bf3856ad364e35_10.0.15063.0_none_0415d1484f341717\@edptoastimage.png	Tray.exe
File opened for modification	C:\Windows\WinSxS\x86_netfx4-aspnet_webadmin_help_b03f5f7f11d50a3a_4.0.14917.0_none_c1711919101c2eef\WebAdminHelp_Internals.aspx	Tray.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.15063.0_none_6aac5ddef84ce0a1.manifest	Tray.exe
File opened for modification	C:\Windows\WinSxS\x86_netfx4-mscorlib_ni_b03f5f7f11d50a3a_4.0.14917.0_none_3721d027b2986727\mscorlib.ni.dll	Tray.exe
File opened for modification	C:\Windows\diagnostics\system\Networking\HTInteractiveRes.ps1	Tray.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-snmp-evntcmd.resources_31bf3856ad364e35_10.0.15063.0_en-us_e59ec39c350a7f4b.manifest	Tray.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_10.0.15063.0_en-us_d2c62b90da3c564e.manifest	Tray.exe
File opened for modification	C:\Windows\InfusedApps\Packages\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Assets\Fonts\MsgMDL2.ttf	Tray.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_mdmvv.inf.resources_31bf3856ad364e35_10.0.15063.0_en-us_a459c0cc1d35407d.manifest	Tray.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Internals.aspx.resx	Tray.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-msidntld_31bf3856ad364e35_10.0.15063.0_none_fb9b797c675265bb.manifest	Tray.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\PenIMC.dll	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-com-adm.resources_31bf3856ad364e35_10.0.15063.0_en-us_990051dd391487d9\COM.adml	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.15063.0_none_5eb55a9a4356bc39\DefaultSystemNotification.contrast-white_scale-200.png	Tray.exe
File opened for modification	C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-n..orkconnectionbroker_31bf3856ad364e35_10.0.15063.0_none_7817d3bd3211492c.manifest	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..etoolsgui.resources_31bf3856ad364e35_10.0.15063.0_en-us_669d6b237c8977e3\wvc.dll.mui	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_networking-mpssvc-netsh-tracing_31bf3856ad364e35_10.0.15063.0_none_a3b8db13ff97bd68\authfwcfg.mof	Tray.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-s..resources.resources_31bf3856ad364e35_10.0.15063.0_en-us_178e7fdce2e453a7.manifest	Tray.exe
File opened for modification	C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.15063.0_none_6cd5a5d60e5909d1.manifest	Tray.exe
File opened for modification	C:\Windows\InfusedApps\Packages\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-24_altform-unplated.png	Tray.exe
File opened for modification	C:\Windows\InfusedApps\Packages\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\blushing.png	Tray.exe
File opened for modification	C:\Windows\InfusedApps\Packages\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\ne_60x42.png	Tray.exe
File opened for modification	C:\Windows\InfusedApps\Packages\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_contrast-white.png	Tray.exe
File opened for modification	C:\Windows\InfusedApps\Packages\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\daily_challenge.jpg	Tray.exe
File opened for modification	C:\Windows\WinSxS\FileMaps\programdata_microsoft_windows_security_health_ef9cc294168a8b97.cdf-ms	Tray.exe
File opened for modification	C:\Windows\Fonts\phagspa.ttf	Tray.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-OneCore-Containers-Opt-Package~31bf3856ad364e35~amd64~en-US~10.0.15063.0.mum	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.15063.0_none_2bd1e3a1cfd67be0\logo.scale-400_altform-unplated.png	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..s-classicsearchdata_31bf3856ad364e35_10.0.15063.0_none_2bf46985bc0de379\Classic_{1206f5f1-0569-412c-8fec-3204630dfb70}.settingcontent-ms	Tray.exe
File opened for modification	C:\Windows\WinSxS\amd64_prnhpcl4.inf_31bf3856ad364e35_10.0.15063.0_none_0990f26dfbfb201c\amd64\hpipcl3at.gpd	Tray.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-p..gssystems.resources_31bf3856ad364e35_10.0.15063.0_en-us_776a0f4c462a25fa\pegi.rs.mui	Tray.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

werfault.exe

description pid process

Token: SeRestorePrivilege 4788 werfault.exe
Token: SeBackupPrivilege 4788 werfault.exe

description	pid	process
Token: SeRestorePrivilege	4788	werfault.exe
Token: SeBackupPrivilege	4788	werfault.exe

C:\Users\Admin\AppData\Local\Temp\Tray.exe
"C:\Users\Admin\AppData\Local\Temp\Tray.exe"
1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Windows directory
PID:4092

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\b788965c6bb147ed9dc35498be823c95 /t 4012 /p 4092
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4788

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\AppCompat\Programs\Amcache.hve
MD5
37af1953ea9a82402d3ff623854853db

SHA1
310ea59632ce3b789761567d6e82d6bc6cbd98f1

SHA256
af0fda2e1451761b9002530446eed5bae76c7809023477798a853ac8602450a3

SHA512
291f844118c6b73b3b055dc066c6a616bf64ab1f1ba33c806266795a40a6eed093f7c358728ecb113a94ef2f37ebb93afd5c486891c5d63ac7679a0616abf822

Download Submit
memory/4092-114-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/4092-116-0x00000000053B0000-0x00000000053B1000-memory.dmp

Filesize
4KB

Download
memory/4092-117-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/4092-118-0x0000000004F20000-0x0000000004F21000-memory.dmp

Filesize
4KB

Download
memory/4092-119-0x0000000004EB0000-0x00000000053AE000-memory.dmp

Filesize
5.0MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads